---
id: CVE-2022-50440
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/vmwgfx: Validate the box size for the snooped cursor

  Invalid userspace dma surface copies could potentially overflow
  the memcpy from the surface to the snooped ima…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/vmwgfx: Validate the box size for the snooped cursor

  Invalid userspace dma surface copies could potentially overflow
  the memcpy from the surface to the snooped ima…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-476
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 3.2, < 4.9.337'
  - 'linux_kernel >= 4.10, < 4.14.303'
  - 'linux_kernel >= 4.15, < 4.19.270'
  - 'linux_kernel >= 4.20, < 5.4.229'
  - 'linux_kernel >= 5.5, < 5.10.163'
  - 'linux_kernel >= 5.11, < 5.15.87'
  - 'linux_kernel >= 5.16, < 6.0.18'
  - 'linux_kernel >= 6.1, < 6.1.4'
patched:
  - linux_kernel 6.1.4
published: '2025-10-01'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:17:30.637'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-50440'
references:
  - url: 'https://git.kernel.org/stable/c/439cbbc1519547f9a7b483f0de33b556ebfec901'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4cf949c7fafe21e085a4ee386bb2dade9067316e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4d54d11b49860686331c58a00f733b16a93edfc4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/50d177f90b63ea4138560e500d92be5e4c928186'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/622d527decaac0eb65512acada935a0fdc1d0202'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6948e570f54f2044dd4da444b10471373a047eeb'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6b4e70a428b5a11f56db94047b68e144529fe512'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/94b283341f9f3f0ed56a360533766377a01540e0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ee8d31836cbe7c26e207bfa0a4a726f0a25cfcf6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00171
epssPercentile: 0.06486
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:31:08.687725Z'
ingestedAt: '2026-10-15T21:45:11.280Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: Validate the box size for the snooped cursor

Invalid userspace dma surface copies could potentially overflow
the memcpy from the surface to the snooped image leading to crashes.
To fix it the dimensions of the copybox have to be validated
against the expected size of the snooped cursor.

## Affected

- `linux_kernel >= 3.2, < 4.9.337`
- `linux_kernel >= 4.10, < 4.14.303`
- `linux_kernel >= 4.15, < 4.19.270`
- `linux_kernel >= 4.20, < 5.4.229`
- `linux_kernel >= 5.5, < 5.10.163`
- `linux_kernel >= 5.11, < 5.15.87`
- `linux_kernel >= 5.16, < 6.0.18`
- `linux_kernel >= 6.1, < 6.1.4`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.1.4`